Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 121:

  An analyst wants to run a script to remove usernames from an incident before the incident becomes active in XSOAR. How can this be achieved?

  A. Run an automation script in the Playground to remove usernames from the incident.
  B. Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.
  C. Run an automation script on the XSOAR server to remove usernames from the incident.
  D. Create a playbook task to remove the usernames from the incident.
  B. Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Incident-Management

• Question 122:

  Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

  A. Add a distributed database server
  B. Add an indexing server
  C. Add a live backup server (disaster recovery)
  D. Add an engine
  A. Add a distributed database server
  C. Add a live backup server (disaster recovery)

• Question 123:

  Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)

  A. setFields
  B. Field mapping
  C. setIncident
  D. Layout inline editing
  B. Field mapping
  C. setIncident

• Question 124:

  A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

  A. Manually share the dashboard through user emails
  B. Dashboard is shared to all XSOAR users
  C. Propagate the dashboard based on SAML authentication
  D. Dashboard is shared to all XSOAR users in a selected role
  D. Dashboard is shared to all XSOAR users in a selected role

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/dashboards/share- a-dashboard.html

• Question 125:

  In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?

  A. Cron job
  B. Time triggered job
  C. Feed triggered job
  D. REST API job
  C. Feed triggered job

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR- Administrator-Guide/Create-Indicator-Extract-Rules-for-a-Playbook-Task

• Question 126:

  For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

  A. /var/lib/demisto
  B. /tmp/log/demisto
  C. /usr/local/demisto
  D. /var/log/demisto
  D. /var/log/demisto

• Question 127:

  Which of the following are valid methods to contribute custom content? (Choose three.)

  A. Submit content directly through feature requests
  B. Private GitHub repository submission for premium content
  C. A Github pull request on the public XSOAR Content Repository
  D. Using the marketplace interface to upload the content
  E. Using the content submission tool on live.paloaltonetworks.com
  C. A Github pull request on the public XSOAR Content Repository
  D. Using the marketplace interface to upload the content
  E. Using the content submission tool on live.paloaltonetworks.com

• Question 128:

  By default, which components does an XSOAR implementation include?

  A. XSOAR server, XSOAR engine
  B. Application server, distributed DB server
  C. Application server, distributed DB server, Backup server
  D. All in one server
  B. Application server, distributed DB server

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/installation/install- demisto-on-a-physical-or-virtual-server.html

• Question 129:

  What are two main uses of context data? (Choose two.)

  A. Store incident information in JSON format
  B. Store incident information in XML format
  C. Pass data between playbook tasks
  D. Pass data between to-do tasks
  A. Store incident information in JSON format
  C. Pass data between playbook tasks

  ---

  Explanation/Reference:

  Reference: https://xsoar.pan.dev/docs/integrations/context-and- outputs#:~:text=The%20main%20use%20of%20the,the%20Context%20and%20uses%20it.

• Question 130:

  Reliability scores in XSOAR range from A through F. What do A and F stand for?

  A. F - Reliability cannot be judged, A - Completely Reliable
  B. F - Not reliable, A - Usually Reliable
  C. F - Not usually reliable, A - Fairly Reliable
  D. F - Unreliable, A - Completely Reliable
  D. F - Unreliable, A - Completely Reliable